I would hope you are logging in with your IPD credentials using something like Jamf Connect, or PSSO and not "Windows" credentials through AD from domain binding :).
Configuring Macs and Windows devices have very few similarities. As far as when to install a VPN client, I prefer to have that be the last package to install in a configuration because it can interrupt network traffic failing your other packages.
My suggestion: Make 1 policy for each application and script to keep them separate from each other. For the policies with packages, set a priority for each package in Jamf > Settings > Packages as Jamf will run the packages in order of priority if they are set, else it's alphabetically. Finally, set all these policies to run at enrollment and recurring checkin once per device. This will ensure they install as the device enrolls. You can also place packages in the Prestage, but use that sparingly.
